I want to move away from Cloudflare tunnels, so I rented a cheap VPS from Hetzner and tried to follow this guide. Unfortunately, the WireGuard setup didn’t work. I’m trying to forward all traffic from the VPS to my homeserver and vice versa. Are there any other ways to solve this issue?

VPS Info:

OS: Debian 12

Architecture: ARM64 / aarch64

RAM: 4 GB

Traffic: 20 TB

  • AlexPewMasterOPEnglish
    1·
    8 months ago

    I do not get a response when pinging the VPS’s WG IP from my homeserver. It might have something to do with the firewall that my VPS provider (Hetzner) is using. I’ve now allowed the port 51820 on UDP and TCP and it’s still the same as before… This is weird.

    • Admiral Patrick@dubvee.orgEnglish
      2·
      8 months ago

      I’m not familiar with Hetzner, but I know people use them; haven’t heard any kinds of blocks for WG traffic (though I’ve read they do block outbound SMTP).

      Maybe double-check your public and private WG keys on both ends. If the keys aren’t right, it doesn’t give you any kind of error; the traffic is just silently dropped if it doesn’t decrypt.

      • AlexPewMasterOPEnglish
        2·
        8 months ago

        Hmm, the keys do match on the two different machines. I have no idea why this doesn’t work…

        • Admiral Patrick@dubvee.orgEnglish
          2·
          8 months ago

          Dumb question: you’re starting wireguard right? lol

          In most distros, it’s systemctl start wg-quick@wg0 where wg0 is the name of the config file in /etc/wireguard

          If so, then maybe double/triple check any firewalls / iptables rules. My VPS providers don’t have any kind of firewall in front of the VM, but I’m not sure about Hetzner.

          Maybe try stopping wireguard, starting a netcat listener on 51820 UDP and seeing if you can send to it from your homelab. This will validate that the UDP port is open and your lab can make the connection.

          ### VPS
user@vps:  nc -l -u VPS_PUBLIC_IP 51820

### Homelab
user@home:  echo "Testing" | nc -u VPS_PUBLIC_IP 51820

### If successful, VPS should show:
user@vps:  nc -l -u VPS_PUBLIC_IP 51820
Testing

          I do know this is possible as I’ve made it work with CG-NAT on both ends (each end was a client and routed through the VPS).

          • AlexPewMasterOPEnglish
            2·
            8 months ago

            The command you provided for the VPS returns UDP listen needs -p arg, so I just added -p right before the port number and then it worked. Running the homelab command returns no port[s] to connect to… Not good.

            • Admiral Patrick@dubvee.orgEnglish
              3·
              8 months ago

              At least that points you to the problem: firewall somewhere.

              Try a different port with your netcat test, perhaps? 51820 is the well-known WG port. Can’t imagine they’d intentionally block it, but you never know.

              Maybe Hetzner support can offer more guidance? Again, I’m not sure what or how they do network traffic before it gets to the VM. On all of mine, it’s just a raw gateway and up to me to handle all port blocking.

              If you figure that part out and are still stuck on the WG part, just shoot me a reply.

              • AlexPewMasterOPEnglish
                2·
                8 months ago

                I tried to open the port 22 on UDP (yeah, I am getting pretty desperate over here…) and still get the message no port[s] to connect to… Someone else on this post commented that I should stop using iptables for opening ports and start using something else as a firewall. Should I try this approach?